diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a6e242bf..4cc17663 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -25,7 +25,7 @@ jobs:
   swift:
     name: Swift docs (DocC)
     timeout-minutes: 45
-    runs-on: [self-hosted, macOS, ARM64]
+    runs-on: [self-hosted, macOS, ARM64, xcode16]
     steps:
       - uses: actions/checkout@v5
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8e2074bf..0e05bcf8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,8 +3,9 @@
 # The Swift xcframework zip is built upstream by release_swift.yml on the
 # `release/v*` PR branch and uploaded to a draft GitHub release. This
 # workflow's create-release job promotes that draft to published; the other
-# jobs then `gh release upload` the rest of the assets to the same release.
-# Single Swift build (in PR CI), no cross-host determinism requirement.
+# jobs then attach the rest of the assets to the same release via
+# softprops/action-gh-release. Single Swift build (in PR CI), no
+# cross-host determinism requirement.
 
 name: release
 on:
@@ -17,8 +18,8 @@ env:
   PACKAGE_NAME: libiroh
   IROH_FORCE_STAGING_RELAYS: "1"
 
-# `gh release upload` + `gh release edit --draft=false` both need write
-# access to the release.
+# softprops/action-gh-release edits the release + uploads assets under
+# GITHUB_TOKEN; needs write on contents.
 permissions:
   contents: write
 
@@ -27,7 +28,7 @@ jobs:
   # the Swift xcframework zip already attached and the SHA already baked into
   # Package.swift on main. Tag time, this job just promotes the draft to
   # published (or creates fresh if no draft, e.g. a manual tag without a PR).
-  # Other jobs then `gh release upload` the rest of the assets.
+  # Other jobs then attach the rest of the assets to the same release.
   create-release:
     name: create-release
     runs-on: ubuntu-latest
@@ -42,26 +43,12 @@ jobs:
       run: |
         echo "RELEASE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
         echo "version is: ${GITHUB_REF#refs/tags/}"
-    - name: Checkout repository
-      uses: actions/checkout@v5
-      with:
-        fetch-depth: 1
     - name: Promote draft release (or create fresh)
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG: ${{ env.RELEASE_VERSION }}
-      shell: bash
-      run: |
-        set -eu
-        if gh release view "$TAG" --json isDraft -q .isDraft 2>/dev/null | grep -q true; then
-          echo "Promoting existing draft $TAG to published"
-          gh release edit "$TAG" --draft=false
-        elif ! gh release view "$TAG" >/dev/null 2>&1; then
-          echo "Creating fresh published release $TAG (no draft from release_swift.yml)"
-          gh release create "$TAG" --title "$TAG" --notes ""
-        else
-          echo "Release $TAG already published"
-        fi
+      uses: softprops/action-gh-release@v3
+      with:
+        tag_name: ${{ env.RELEASE_VERSION }}
+        name: ${{ env.RELEASE_VERSION }}
+        draft: false
 
   build-and-publish-libs:
     name: Build & publish release libraries
@@ -131,11 +118,11 @@ jobs:
           echo "ASSET=$staging.tar.gz" >> $GITHUB_ENV
         fi
     - name: Upload release archive
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        TAG: ${{ needs.create-release.outputs.release_version }}
-      shell: bash
-      run: gh release upload "$TAG" "$ASSET" --clobber
+      uses: softprops/action-gh-release@v3
+      with:
+        tag_name: ${{ needs.create-release.outputs.release_version }}
+        files: ${{ env.ASSET }}
+        fail_on_unmatched_files: true
 
   # build-and-publish-swift was here. The Swift xcframework now ships from
   # release_swift.yml on the release/v* PR branch (it's already attached to
@@ -204,6 +191,10 @@ jobs:
         with:
           targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
       - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: "17"
       - uses: android-actions/setup-android@v3
       - name: Setup Android NDK
         uses: arqu/setup-ndk@main
diff --git a/.github/workflows/release_swift.yml b/.github/workflows/release_swift.yml
index b08c731d..ac564adc 100644
--- a/.github/workflows/release_swift.yml
+++ b/.github/workflows/release_swift.yml
@@ -44,7 +44,7 @@ jobs:
           V=$(grep -oE 'let releaseTag = "v[^"]+"' Package.swift | sed -E 's/.*"(v[^"]+)"/\1/')
           echo "tag=$V" >> "$GITHUB_OUTPUT"
       - name: Upload zip to draft GitHub release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           draft: true
           tag_name: ${{ steps.release_tag.outputs.tag }}